Palo Alto Networks · Agentic Access

Palo Alto Networks Agentic Access

x-agentic-access generated

Palo Alto Networks exposes 526 API operations that an AI agent could call, of which 269 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 257 read, 259 write, 5 physical, and 5 safety-critical.

5 operations are classed safety-critical and should require human-in-the-loop approval at runtime.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR
Operations: 526 Acting: 269 Human-in-the-loop: 5 Method: generated

By consequence

read 257 write 259 physical 5 safety-critical 5

Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.

MethodPathConsequenceHuman-in-loop
PUT /api/cloud/2.0/agg/notifications/profiles/opstate safety-critical required
PUT /api/v1/user/{username}/credential safety-critical required
POST /api/v1/user/{username}/credential/reset-token/validate safety-critical required
POST /mobile-agent/infrastructure-settings safety-critical required
DELETE /service-accounts/{id}/keys/{key_id} safety-critical required
POST /mt/sp-interconnect/interconnects/physical-connections physical conditional
POST /mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments physical conditional
POST /v1/deployments physical conditional
PUT /v1/deployments/{deployment_id} physical conditional
DELETE /v1/deployments/{deployment_id} physical conditional

Source

Agentic Access

Raw ↑ 
generated: '2026-07-15'
method: generated
source: openapi/palo-alto-aiops-ngfw-bpa-api-openapi-original.yml, openapi/palo-alto-autonomous-dem-api-openapi-original.yml,
  openapi/palo-alto-cloud-identity-engine-api-openapi-original.yml, openapi/palo-alto-cloud-ngfw-api-openapi-original.yml,
  openapi/palo-alto-cortex-xdr-api-openapi-original.yml, openapi/palo-alto-cortex-xpanse-api-openapi-original.yml,
  openapi/palo-alto-cortex-xsiam-api-openapi-original.yml, openapi/palo-alto-cortex-xsoar-api-openapi-original.yml,
  openapi/palo-alto-dlp-api-openapi-original.yml, openapi/palo-alto-dns-security-api-openapi-original.yml,
  openapi/palo-alto-email-dlp-api-openapi-original.yml, openapi/palo-alto-identity-security-posture-management-api-openapi-original.yml,
  openapi/palo-alto-iot-security-api-openapi-original.yml, openapi/palo-alto-pan-os-rest-api-openapi-original.yml,
  openapi/palo-alto-prisma-access-api-openapi-original.yml, openapi/palo-alto-prisma-access-browser-api-openapi-original.yml,
  openapi/palo-alto-prisma-access-insights-api-openapi-original.yml, openapi/palo-alto-prisma-airs-ai-red-teaming-api-openapi-original.yml,
  openapi/palo-alto-prisma-airs-api-openapi-original.yml, openapi/palo-alto-prisma-cloud-code-security-api-openapi-original.yml,
  openapi/palo-alto-prisma-cloud-compute-api-openapi-original.yml, openapi/palo-alto-prisma-cloud-cspm-api-openapi-original.yml,
  openapi/palo-alto-prisma-cloud-dspm-api-openapi-original.yml, openapi/palo-alto-prisma-cloud-mssp-api-openapi-original.json,
  openapi/palo-alto-prisma-sd-wan-api-openapi-original.yml, openapi/palo-alto-saas-security-api-openapi-original.yml,
  openapi/palo-alto-sase-5g-api-openapi-original.yml, openapi/palo-alto-sase-5g-monitor-api-openapi-original.yml,
  openapi/palo-alto-sase-aggregate-monitoring-api-openapi-original.yml, openapi/palo-alto-sase-config-orchestration-api-openapi-original.yml,
  openapi/palo-alto-sase-iam-api-openapi-original.yml, openapi/palo-alto-sase-multitenant-interconnect-api-openapi-original.yml,
  openapi/palo-alto-sase-multitenant-notifications-api-openapi-original.yml, openapi/palo-alto-sase-subscription-api-openapi-original.yml,
  openapi/palo-alto-sase-tenancy-api-openapi-original.yml, openapi/palo-alto-security-advisory-api-openapi-original.yml,
  openapi/palo-alto-sspm-api-openapi-original.yml, openapi/palo-alto-strata-cloud-manager-api-openapi-original.yml,
  openapi/palo-alto-strata-logging-service-api-openapi-original.yml, openapi/palo-alto-threat-vault-api-openapi-original.yml,
  openapi/palo-alto-wildfire-api-openapi-original.yml, openapi/palo-alto-ztna-connector-api-openapi-original.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 526
  by_action_class:
    acting: 269
    connected: 257
  by_consequence:
    write: 259
    read: 257
    safety-critical: 5
    physical: 5
  human_in_the_loop_required: 5
operations:
- path: /requests
  method: post
  operationId: submitBPARequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /requests/{request_id}
  method: get
  operationId: getBPARequestStatus
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /reports/{report_id}
  method: get
  operationId: getBPAReport
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /reports/{report_id}/checks
  method: get
  operationId: getBPAReportChecks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/applications/scores
  method: get
  operationId: getApplicationScores
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/agents/scores
  method: get
  operationId: getAgentScores
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/tests/{test_id}/results
  method: get
  operationId: getTestResults
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/applications
  method: get
  operationId: listMonitoredApplications
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/agents
  method: get
  operationId: listMonitoredAgents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /mt/monitor/adem/v1/metrics
  method: get
  operationId: getPerformanceMetrics
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: https://api.sase.paloaltonetworks.com/cie/directory-sync/v1/domains
  method: get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: https://api.sase.paloaltonetworks.com/cie/directory-sync/v1/cache-users
  method: post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: https://api.sase.paloaltonetworks.com/cie/directory-sync/v1/cache-groups
  method: post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks
  method: get
  operationId: listRuleStacks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks
  method: post
  operationId: createRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}
  method: get
  operationId: getRuleStack
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}
  method: put
  operationId: updateRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}
  method: delete
  operationId: deleteRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/commit
  method: post
  operationId: commitRuleStack
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/security-rules
  method: get
  operationId: listSecurityRules
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/security-rules
  method: post
  operationId: createSecurityRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/security-rules/{priority}
  method: get
  operationId: getSecurityRule
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/security-rules/{priority}
  method: put
  operationId: updateSecurityRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/security-rules/{priority}
  method: delete
  operationId: deleteSecurityRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/fqdnlists
  method: get
  operationId: listFqdnLists
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/fqdnlists
  method: post
  operationId: createFqdnList
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/rulestacks/{rulestack}/prefixlists
  method: get
  operationId: listPrefixLists
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/rulestacks/{rulestack}/prefixlists
  method: post
  operationId: createPrefixList
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/ngfirewalls
  method: get
  operationId: listFirewalls
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/ngfirewalls
  method: post
  operationId: createFirewall
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/ngfirewalls/{firewall}
  method: get
  operationId: getFirewall
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /config/ngfirewalls/{firewall}
  method: put
  operationId: updateFirewall
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /config/ngfirewalls/{firewall}
  method: delete
  operationId: deleteFirewall
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/get_incidents
  method: post
  operationId: getIncidents
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/get_incident_extra_data
  method: post
  operationId: getIncidentExtraData
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/update_incident
  method: post
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /alerts/get_alerts
  method: post
  operationId: getAlerts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/get_endpoints
  method: post
  operationId: getEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/isolate
  method: post
  operationId: isolateEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/unisolate
  method: post
  operationId: unisolateEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/scan
  method: post
  operationId: scanEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /scripts/run_script
  method: post
  operationId: runScript
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /scripts/get_script_execution_results
  method: post
  operationId: getScriptExecutionResults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/start_xql_query
  method: post
  operationId: startXqlQuery
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/get_query_results
  method: post
  operationId: getXqlQueryResults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /audit/get_audit_management_logs
  method: post
  operationId: getAuditManagementLogs
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /assets/get_assets_internet_exposure
  method: post
  operationId: getAssetsInternetExposure
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /assets/get_asset_internet_exposure
  method: post
  operationId: getAssetInternetExposure
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident_management/get_incidents
  method: post
  operationId: getIncidents
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident_management/update_incident
  method: post
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /attack_surface_rules/get_attack_surface_rules
  method: post
  operationId: getAttackSurfaceRules
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /attack_surface_rules/update_attack_surface_rule
  method: post
  operationId: updateAttackSurfaceRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /services/get_services
  method: post
  operationId: getServices
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ip_range/get_owned_ip_ranges
  method: post
  operationId: getOwnedIpRanges
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /audit/get_audit_management_logs
  method: post
  operationId: getAuditManagementLogs
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/get_incidents
  method: post
  operationId: getIncidents
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /alerts/get_alerts
  method: post
  operationId: getAlerts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/start_xql_query
  method: post
  operationId: startXqlQuery
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /xql/get_query_results
  method: post
  operationId: getXqlQueryResults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /assets/list_assets
  method: post
  operationId: listAssets
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /endpoints/get_endpoints
  method: post
  operationId: getEndpoints
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /audits/management_logs/get_management_logs
  method: post
  operationId: getManagementLogs
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ingestion/datasources
  method: post
  operationId: configureDatasource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident
  method: post
  operationId: createIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/search
  method: get
  operationId: searchIncidentsGet
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incidents/search
  method: post
  operationId: searchIncidentsPost
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incident/{id}
  method: get
  operationId: getIncident
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incident/update
  method: post
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /entry
  method: post
  operationId: addEntry
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /investigations/{id}
  method: get
  operationId: getInvestigation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /investigation/add
  method: post
  operationId: createInvestigation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /playbook
  method: get
  operationId: listPlaybooks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /playbook/run
  method: post
  operationId: runPlaybook
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /integration/search
  method: get
  operationId: searchIntegrations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /settings/integration/search
  method: post
  operationId: searchIntegrationInstances
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents
  method: get
  operationId: listIncidents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incidents/{incident_id}
  method: get
  operationId: getIncident
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /incidents/{incident_id}
  method: put
  operationId: updateIncident
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /incidents/{incident_id}/snippets
  method: get
  operationId: getIncidentSnippets
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /data-patterns
  method: get
  operationId: listDataPatterns
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /data-patterns/{id}
  method: get
  operationId: getDataPattern
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /reports/summary
  method: get
  operationId: getReportSummary
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /domain
  method: get
  operationId: getDomain
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /domain/bulk
  method: get
  operationId: getDomainBulk
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stats/network
  method: get
  operationId: getNetworkStats
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents
  method: get
  operationId: listEmailIncidents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents/{id}
  method: get
  operationId: getEmailIncident
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents/{id}/verdict
  method: put
  operationId: updateEmailIncidentVerdict
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /email-incidents/{id}/attachments
  method: get
  operationId: getEmailIncidentAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /email-incidents/{id}/recipients
  method: get
  operationId: getEmailIncidentRecipients
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/catalog/{appType}
  method: get
  operationId: catalog_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps
  method: get
  operationId: idps_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps
  method: post
  operationId: idps_post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sspm/identity/v1/idps/{idpId}/accounts/logout
  method: get
  operationId: idps_accounts_logout_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/accounts/logout
  method: post
  operationId: idps_accounts_logout_post
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sspm/identity/v1/idps/{idpId}/feature_state
  method: get
  operationId: idps_feature_state_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/idp_accounts/count
  method: get
  operationId: idps_idp_accounts_count_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report
  method: post
  operationId: idps_idp_accounts_csv_report_get
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sspm/identity/v1/idps/{idpId}/mfa_activity
  method: get
  operationId: idps_mfa_activity_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/mfa_activity/count
  method: get
  operationId: idps_mfa_activity_count_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type
  method: get
  operationId: idps_mfa_activity_count_by_app_type_get
  x-agentic-access:
    action-class: connected
    con

# --- truncated at 32 KB (151 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/agentic-access/palo-alto-networks-agentic-access.yml

Work with this as data

Every access contract here is available over the APIs.io API and to AI agents over MCP. Agentic Access is not yet its own endpoint on the v1 API. Reach it through catalog search and the tag graph, or the MCP server.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for agentic access

3 MCP tools reach this
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
Search the catalog 
curl "https://apis.io/api/v1/search?q=palo-alto-networks-agentic-access&limit=10"
Everything under a tag 
curl "https://apis.io/api/v1/tags/palo-alto-networks-agentic-access"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.